CVE-2024-2971: 
NixOS vulnerability analysis and mitigation

Out-of-bounds array write vulnerability identified in Xpdf versions 4.05 and earlier. The vulnerability is triggered when processing a PDF file containing a negative object number in an indirect reference (NVD).

The vulnerability has been assigned CVE-2024-2971 and received a CVSS v3.1 base score of 5.5 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write). The issue specifically occurs when processing indirect references in PDF files that contain negative object numbers (NVD).

The vulnerability affects system availability with no direct impact on confidentiality or integrity. When successfully exploited, it can lead to a denial of service condition through an out-of-bounds array write operation (NVD).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is needed to exploit the vulnerability. The attack vector is local, meaning an attacker needs local access to the target system to exploit this vulnerability (NVD).

Users should upgrade to a version newer than Xpdf 4.05 once available. The vulnerability affects all versions up to and including 4.05 (NVD).